Andy Garcia · freelance dev
FRENES
Back to the blog
Security

A French Region Says Two Hacked Vendors Exposed Nearly 545,000 People. Its Aid Portal Stayed Shut.

October 19, 2026 7 min read

On Saturday, October 3, the Hauts-de-France region, in northern France, said in a statement that two of its vendors, Atexo and Docaposte, had suffered a cyberattack "that allowed unauthorized access to personal data processed on its behalf." Atexo, a publisher of software for public bodies, managed and hosted the regional aid platform. Docaposte, La Poste's digital subsidiary, ran the platform behind Carte Génération #HDF, the card the region uses to give financial help to high school students and apprentices.

On Monday, October 5, the region's president, Xavier Bertrand, gave the first numbers at a plenary session of the regional council, as AFP reported. Data on nearly 545,000 people had leaked: at most 515,000 of the 745,000 people registered on the Atexo platform, and nearly 30,000 beneficiaries and partners of Carte Génération.

I have a direct reason to read this one closely. I built BidForge, an AI that reads French public tender files for small businesses, and several of the buyer platforms it downloads those files from run on Atexo's procurement software. So let me be plain about what the sources establish. The region names its aid platform. Nothing published says Atexo's public procurement platforms were touched, and nothing below should be read that way.

What the region confirmed

The October 3 statement, relayed by AFP, franceinfo and France 3, listed names, first names, email addresses, "potentially" bank details and other identification data among the data likely compromised. The bank details here are RIBs, the French account slip that carries an IBAN. The region could not yet give the number of people concerned, or say whether other categories of data had been accessed or extracted. The affected platforms were closed, a complaint was filed, and ANSSI, the national cybersecurity agency, was alerted.

According to franceinfo, users had been informed from Friday, October 2, and a third service, the Maison des entrepreneurs Hauts-de-France platform, was also affected, with that incident "now resolved." The region said the vendors had identified "the flaws as well as the attacker's method" and started the fixes, and AFP reported that the region's own internal information system was not touched.

On October 5, Bertrand was more specific. For the Atexo platform, the leaked data was "names, first names, emails, type of third party, permissions" (in French: "noms, prénoms, mails, type de tiers, habilitations"). It was not yet possible to know whether bank details "were viewed and could have been extracted." For Docaposte, he said, it would mainly be apprenticeship contracts and RIBs.

Note what the 545,000 is: a ceiling for one platform plus an estimate for the other. It is not a count.

What is only claimed

A hacker using the name ChimeraZ claims much more. According to Cyberattaque.org, and to Clubic, which also cites the FrenchBreaches tracker, ChimeraZ published two posts on October 3. One is a database of 782,583 rows covering 708,068 people, said to come from the regional aid site, the Carte Génération site and a business support site. The other is 48 GB of documents, 90,011 files, mostly PDFs, said to come from the Carte Génération partner portal: among them 37,585 apprenticeship contracts, 36,720 RIBs, 15,118 proofs of accommodation and 127 company registration extracts. ChimeraZ also claims to have found passwords typed into the mobile phone field.

The region did not take any of it on board. On October 3, it said: "We are not in a position today to confirm the volume and other categories of documents extracted." Cyberattaque.org itself notes that nothing public allows it to attribute all of the claimed data to the Atexo compromise. I treat these numbers as a claim, and so should you. The same name came back on Saturday, October 17: FrenchBreaches reported a new ChimeraZ post about 1,066 students and parents in PRREL Ambition, a school support scheme, while noting that the post alone does not show the region's own systems were breached.

The word that matters is "habilitations"

Most headlines I read led with the RIBs. Fair: bank details are the frightening part for families. For a business reader, the October 5 list is the more useful one.

My reading, as a developer who builds on French public-sector platforms: in French public administration, a "tiers" is the party a file belongs to (a person, a company, an association, a town), and "habilitations" record who may act for whom. Atexo's own page describes its grants product as covering subsidies to associations, towns and businesses, as well as individual aid. Put the fields together and you get a list of the people who handle grant files, their email address, and the kind of organization they act for.

That is not a key to a bank account. It is the raw material of a convincing email. The one I would expect: "Following the security incident, your aid application must be completed. Please upload your bank details again here." It would be plausible precisely because part of it is true: the platform is closed, and the region has promised retroactive treatment for applications that could not be filed.

If the claim about passwords in the phone field is true, it carries a second lesson for builders. A free text field that accepts anything will, across hundreds of thousands of accounts, end up storing things it was never meant to hold. Checking the shape of what you store is a security control, not a nicety.

A product, not a one-off

Atexo sells this kind of platform to other public bodies. Its site presents a grants product, ATEXO SUB or LOCAL TRUST SUB, with "more than €2 billion" paid out a year, "more than 100,000 users in local authorities" and "more than a million beneficiaries." It also calls itself the French leader in electronic public procurement.

The region has not said which Atexo software ran its platform, and nothing I read says any other Atexo customer was affected. On October 19, Atexo's news page had no item about the incident; its most recent post was dated June 1. If I ran a public body on a hosted grants or procurement platform, my first question now would be simple: is our instance separate from the others, and how would we know?

Two weeks with the counter closed

On October 19, the regional aid platform, aides.hautsdefrance.fr, still returned a maintenance page. It said the platform "is temporarily closed for a thorough security audit, carried out as a precaution following last week's incident. It will reopen once it is concluded. Applications in progress are kept, and retroactivity will apply to applications that could not be filed." Another regional portal, fse.hautsdefrance.fr, showed a similar notice that day.

That is the cost of a breach that is easiest to forget when choosing a vendor. The announcement takes a day. The closed counter lasts weeks, and every association or small business waiting to file for a grant waits with it.

For vendors, the GDPR already sets the frame. Article 33 makes the processor notify its client "without undue delay" after becoming aware of a breach, and makes the client, as controller, notify the supervisory authority within 72 hours where feasible, unless the breach is unlikely to put people at risk. Article 28 requires the processing contract to make the processor "allow for and contribute to audits" by the client or an auditor it mandates. The statements I read mention ANSSI and a complaint to the authorities. They do not mention the CNIL, which does not mean no notification was made.

As CTO of a LegalTech, I read the region's statement as a preview of a vendor's worst day: the client names you in its first press release, and the audit clause you signed turns into a closed service.

What I would check

If your company or association has an account on a public aid or procurement platform:

  1. Know which email address is registered, and whose inbox it is. If it belongs to someone who left, you will not see the real notification either.
  2. Use a password you use nowhere else. If you reused it, change it on the other services first.
  3. Verify any request for bank details or documents through the organization's official contact details, never through the link you received. According to Clubic, the region's letter to users says it will never ask for a password or bank details by email, and that no particular step is needed with the region at this stage.

As for BidForge, it downloads tender files from procurement platforms anonymously: it holds no account and no password there. Reading this story, that is a design line I would keep.

Names and emails leak every week. A list of who acts for which organization, on which public money, is worth more to the next caller.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk